2. Scope and withdrawal of consent for data processing

This Privacy Policy explains to users the collection and use of personal data by InStaff as the operator
of the domain https://instaff.jobs (hereinafter „Website“) and the InStaff application (hereinafter „App“).

A user is defined as every person that visits the website of InStaff (hereinafter "visitor"), created a
staff profile (hereinafter "jobber") or a professional account (hereinafter "client").

The Privacy Policy can accessed and printed out at any time on https://en.instaff.jobs/privacy .
InStaff is entitled to change this Privacy Policy according to applicable law.

Some processes of data processing are only possible with your explicit consent. A withdrawal
of the consent you have given is possible at any time. To withdraw your consent, an informal
email is sufficient.

3. Rights to data portability, Right of access, right to rectification, restriction of processing and erasure and right to lodge a complaint with a supervisory authority

You have the right to receive or have sent to Third Parties the personal data being processed
automatically by us. The data will be provided in a machine-readable format.

Within the legal regulations, you have the right to access the stored personal data,
their origin, their receiver, the purpose of the data processing and - if applicable - a right to
rectification, restriction of processing and erasure of this data. To exercise these
rights, please contact the data protection commissioner.

In case of a breach of data protection law, you as an affected party have the right to lodge
a complaint with the supervisory authority. In the case of InStaff, this is the data protection
commissioner of the state of Berlin.

4. Server logfiles

Data that your browser automatically sends to us are stored in server logfiles. This data includes:

Type and version of the browser
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request
IP address

We do not consolidate these with other data sources. The processing of this data for the performance of a contract
or in order to take steps prior to entering into a contract is allowed according to Art. 6 pas. 1b EU-GDPR.

5. Registration on our website or via the app

You are able to register on our website for the use of some functionalities. The data transferred
only serves the purpose of the provision of the specific offer or service. Required fields at the time
of registration are to be entered completely. Otherwise, we will decline the registration.

In case of important changes, we will inform you via email. The email will be sent to the email
address provided during the registration process.

The processing of data entered during the registration process occurs because of your given
consent (Art. 6 pas. 1a EU-GDPR). We only save the data entered during the registration for the
time span that you are registered on our website. Your data will be deleted once you decide to
cancel your registration. Legally required periods for safekeeping remain unaffected.

6. Data transfer at conclusion of a contract

Personal data will only be forwarded to Third Parties in case of a necessity during the settlement
of the contract. Exemplary Third Parties might be a payment provider or a logistics supplier.
Further transfer of the data will not happen unless you have given your explicit consent regarding
this forwarding.

The foundation for this data processing is Art. 6 pas. 1b EU-GDPR, that allows the processing
of data for the performance of a contract or in order to take steps prior to entering into a contract.

7. Storage of data regarding electronic and postal communication

InStaff as an operator stores data regarding electronic and postal communication. This includes the time,
the sender, the receiver, the subject and the content of emails and letters that have been sent prior to or
after having entered into a contract.

The storage of electronic and postal communication is carried out to avoid possibilities of fraud. This
constitutes a legitimate interest of InStaff according to Art. 6 pas. 1f EU-GDPR.

8. Selective publishing of personal data of jobbers

Jobbers are able to selectively publish their own data (e.g. profile picture, working experience,
job reports and client reviews) through our website and / or our app. If the jobber gives his
consent, this data is published on the website, so the jobbers comes to the attention of potential
clients and receives more job offers.

This selective publishing of personal data is voluntary. Jobbers can always edit their profile
settings so that this data is not publicly visible anymore.

9. Binding job interest from jobber

Jobber regularly receive job offers from InStaff via email. If a jobber states his binding interest
in a job, InStaff reserves the right to forward the contact data (Email address and phone number)
to the author of this job offer to clear the details of this job. Furthermore, InStaff receives the right
to contact this jobber via phone or email to clear the details of this job.

After the booking of a jobber for a job, InStaff forwards the contact data of this jobber (Email
address and phone number) to the author of the respective job offer to clear the details of this job.

10. Publishing of job offers

If necessary, InStaff publishes the job offers of clients on Third Party platforms to successfully staff
the jobs of this client. However, InStaff will merely publish the job description and the underlying
data (begin, end, location and working time of the job). InStaff will never publish the contact data
or other personal data of the contact person of the client.

For this reason, the client guarantees not to enter contact data or other data that explicitly
identifies the contact person of the client or any other person.

11. Contact form

Data transferred via the contact form will be saved with your contact data in order to process your
request. This data will not be transferred without your explicit consent. The processing of data entered
into the contact form occurs because of your given consent (Art. 6 pas. 1a EU-GDPR).

Data entered via the contact form will stay with us until you request the erasure, withdraw the
consent of the data processing or there is no more need for the storage of this data. Legally
required periods for safekeeping remain unaffected.

12. Privacy Policy for applications

Personal data of applicants will be processed for the application procedure. In case the applicant
is employed with InStaff afterwards, this data will be stored during the period of the employment
in compliance with legal requirements. In case the applicant is not employed with InStaff afterwards,
the application data will be automatically deleted four months after the announcement of the
rejection if there is no other legitimate interest of InStaff according to Art. 6 pas. 1f EU-GDPR.
A legitimate interest according to Art. 6 pas. 1f EU-GDPR in this case can be the burden of
proof according to the German Allgemeinen Gleichbehandlungsgesetz (AGG) in a trial.

13. Storage time of contributions and comments

Contributions and comments are stored. The content stays on our website until it was fully
erased or had to be erased for legal reasons. The storage of contributions and comments occurs
because of your given consent (Art. 6 pas. 1a EU-GDPR).

14. Cookies

Our website uses one cookie. This is a small text file that your web browser stores on your
end device. They help us to recognize you when coming back to our website and thus make our
offer more user-friendly, effective and more secure. With this cookie, we store the information
which jobber or client is logged in and the information at what time and through the request of
which URL the cookie was created.

The cookies are stored on your end device until you delete them yourself. If you use a modern
web browser, you can monitor, restrict and prohibit the setting of cookies. Many web browsers
are configurable in a way that cookies are being deleted automatically when closing down a
program. The deactivation of cookies may limit certain functionalities of our website.

The setting of cookies for the use of electronic communication purposes or the provision of
certain services that you requested (e.g. the staff selection) occurs according to Art. 6 pas. 1f EU-GDPR.
As the operator of this website, we have a legitimate interest in the storage of cookies for
the technically accurate and smooth presentation of our services. In case other types of cookies
are set (e.g. for analysis reasons), they are treated in a separate section of the privacy policy.

15. YouTube

For the integration and presentation of video contents, our website uses plug-ins from YouTube.
Operator of the video portal is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. Details
regarding the processing of user data can be found in the privacy policy of YouTube on
https://policies.google.com/privacy?hl=en&gl=de.

When accessing a page with an integrated YouTube plug-in, a connection is established to the servers
of YouTube. Thus, YouTube is finding out which of our pages you accessed.
YouTube is able to match your website navigation in case you are logged in in your personal YouTube
account. You have the possibility to prevent this by logging out of YouTube beforehand.
YouTube is used because of our interest in the appealing presentation of our online offers. This
constitutes a legitimate interest of InStaff according to Art. 6 pas. 1f EU-GDPR.

AdWords is an online ad program. In the context of this online ad program, we work with
conversion tracking. After a click on an ad shown by Google, a so called "Google Click ID" is being
forwarded to InStaff and (when a client carries out the registration) assigned to this client. In case this client
carries out the booking of staff within 90 days, InStaff will upload information about the amount in EUR of this booking,
the date of the booking and the "Google Click ID" into our Adwords account. Thus, InStaff is able to analyze
which ad campaigns are successful. At no point in time, other information about the client and / or personal data
is being transferred to Google.

The storage and matching of the "Google Click ID" occurs according to Art. 6 pas. 1f EU-GDPR. We have
a legitimate interest in the analysis of the success of our web ads.